CVE-2020-12101

The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by manipulating an id field in the POST request for altering an address.

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0 NVD

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

1.99% chance of exploitation in the next 30 days, 80th percentile

Published

2020-04-30

Updated

2024-08-04

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/157534/xt-Commerce-5.4.1-6.2.1-6.2.2-Improper-Access…
• http://seclists.org/fulldisclosure/2020/May/0
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-012.txt

Security advisories

• https://helpdesk.xt-commerce.com/index.php?/Knowledgebase/Article/View/1784/294/adressbuc…

References

• CVE Record
• NVD entry